fix(sandbox): narrow admin-API surface to api/core, keep customer api/front open
The api prefix covered both api/core/* (API to admin) and api/front/*
(the customer-facing REST API: front login, member orders). Guarding the
whole api prefix would wrongly block customer API calls.
Narrow admin_surface_prefixes to api/core so only the admin-facing API is
sandboxed; storefront web checkout/registration (Livewire) and the customer
REST API (api/front/*) keep working. version 2.0.3.
Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com